[Resolved] windows update error: code 80244019

What the Tech? It's as easy as 1,2,3! ( Log In | Register )

What the Tech > Spyware / Malware / Virus Removal > Infections Removal

6 Pages

< 1 2 3 4 > »

[Resolved] windows update error: code 80244019, My windows and antivirus software can not update

Options

Tomk View Member Profile	Jun 22 2009, 11:05 AM Post #16
Forum God Group: Classroom Teacher Posts: 11,231 Joined: 27-December 07 From: Sisters, OR Member No.: 75,503 Operating System: xp	seriouscode, Let's get an online scan to make sure we aren't missing something. Please go to Kaspersky website and perform an online antivirus scan. Read through the requirements and privacy statement and click on Accept button. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run. When the downloads have finished, click on Settings. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button: Spyware, Adware, Dialers, and other potentially dangerous programs Archives Mail databases Click on My Computer under Scan. Once the scan is complete, it will display the results. Click on View Scan Report. You will see a list of infected items there. Click on Save Report As.... Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Please post this log in your next reply. Also please tell me how things are running now.

seriouscode View Member Profile	Jun 22 2009, 06:08 PM Post #17
Authentic Member Group: Authentic Member Posts: 75 Joined: 16-June 09 Member No.: 86,305 Operating System: Windows Vista	Tomk so far things on the homefront seem to be running as smooth as ice, all systems go. Here is the Kaspersky online scan log, what next? -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7.0 REPORT Monday, June 22, 2009 Operating System: Microsoft Windows Vista Home Premium Edition, 32-bit Service Pack 1 (build 6001) Kaspersky Online Scanner version: 7.0.26.13 Program database last update: Monday, June 22, 2009 22:57:55 Records in database: 2378674 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ E:\ Scan statistics: Files scanned: 145532 Threat name: 0 Infected objects: 0 Suspicious objects: 0 Duration of the scan: 02:05:01 No malware has been detected. The scan area is clean. The selected area was scanned.

Tomk View Member Profile	Jun 22 2009, 06:39 PM Post #18
Forum God Group: Classroom Teacher Posts: 11,231 Joined: 27-December 07 From: Sisters, OR Member No.: 75,503 Operating System: xp	seriouscode, This computer appears to be clean. Now please run Mbam on the other computers connected to this router. Remember, if anything besides wareout/ Trojan.DNSChanger is found, then I need you to post the report here along with a HijackThis log from that computer. Once we are through with the other computers, I have some housekeeping steps I need you to run and then I'll leave you with some advice for the future.

seriouscode View Member Profile	Jun 22 2009, 11:01 PM Post #19
Authentic Member Group: Authentic Member Posts: 75 Joined: 16-June 09 Member No.: 86,305 Operating System: Windows Vista	Tomk this is the other computers Mbam log. I gotta warn you thu, this one should be a real treat. This is an older computer from 04 that still runs, but it runs so slow that it takes about 10mins to boot up... somewhat. This may be out of you field of service, but if you can help me make this computer run a bit faster, that would be fan-tab-u-lous! Also, why is it slow? Here is the Mbam log: Malwarebytes' Anti-Malware 1.38 Database version: 2323 Windows 5.1.2600 Service Pack 3 6/23/2009 12:18:40 AM mbam-log-2009-06-23 (00-18-40).txt Scan type: Quick Scan Objects scanned: 106790 Time elapsed: 14 minute(s), 39 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 13 Registry Values Infected: 1 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 2 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Delete on reboot. HKEY_CLASSES_ROOT\Typelib\{d518921a-4a03-425e-9873-b9a71756821e} (Adware.MyWebSearch) -> Delete on reboot. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59c7fc09-1c83-4648-b3e6-003d2bbc7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170b96c-28d4-4626-8358-27e6caeef907} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ddb1968e-ead6-40fd-8dae-ff14757f60c7} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f138d901-86f0-4383-99b6-9cdd406036da} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWay) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MenuExt\&Search\ (Adware.Hotbar) -> Quarantined and deleted successfully. Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: c:\documents and settings\sebastian\local settings\Temp\MWSSRCSP.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully. c:\WINDOWS\Temp\TMP0000004023C5ED54332139DF (Adware.MyWeb) -> Quarantined and deleted successfully. Here is the HJT log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:58:39 AM, on 6/23/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\Program Files\Spyware Doctor\pctsSvc.exe C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE C:\WINDOWS\system32\wbem\unsecapp.exe C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\wuauclt.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.live.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.live.com/sphome.aspx R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = 192.168.1.2 F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe" O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [SansaDispatch] C:\Program Files\SanDisk\Sansa Updater\SansaDispatch.exe O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe" O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user') O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {362C56AA-6E4F-40C7-A0B5-85501DBDAD77} (Scanner.SysScanner) - http://i.dell.com/images/global/js/scanner/SysProExe.cab O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe -- End of file - 7515 bytes

Tomk View Member Profile	Jun 22 2009, 11:34 PM Post #20
Forum God Group: Classroom Teacher Posts: 11,231 Joined: 27-December 07 From: Sisters, OR Member No.: 75,503 Operating System: xp	seriouscode, That should have speeded it up. Let's get an online scan on it. Please go to Kaspersky website and perform an online antivirus scan. Read through the requirements and privacy statement and click on Accept button. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run. When the downloads have finished, click on Settings. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button: Spyware, Adware, Dialers, and other potentially dangerous programs Archives Mail databases Click on My Computer under Scan. Once the scan is complete, it will display the results. Click on View Scan Report. You will see a list of infected items there. Click on Save Report As.... Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Please post this log in your next reply.

seriouscode View Member Profile	Jun 23 2009, 01:32 PM Post #21
Authentic Member Group: Authentic Member Posts: 75 Joined: 16-June 09 Member No.: 86,305 Operating System: Windows Vista	Tomk here is the K log from that online scan you asked for: -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7.0 REPORT Tuesday, June 23, 2009 Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Program database last update: Tuesday, June 23, 2009 14:45:55 Records in database: 2383530 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: A:\ C:\ D:\ E:\ Scan statistics: Files scanned: 66620 Threat name: 1 Infected objects: 3 Suspicious objects: 0 Duration of the scan: 02:26:37 File name / Threat name / Threats count C:\Documents and Settings\Sebastian\Local Settings\Temporary Internet Files\Content.IE5\4LTS9I03\setup[1].exe Infected: Trojan-Downloader.Win32.FraudLoad.eki 1 C:\Documents and Settings\Sebastian\Local Settings\Temporary Internet Files\Content.IE5\4LTS9I03\setup[2].exe Infected: Trojan-Downloader.Win32.FraudLoad.eki 1 C:\RECYCLER\S-1-5-21-682003330-1078145449-725345543-1004\Dc1.exe Infected: Trojan-Downloader.Win32.FraudLoad.eki 1 The selected area was scanned. This computer is still running mega slow any other helpful hints you can give me on making it faster?

Tomk View Member Profile	Jun 23 2009, 02:29 PM Post #22
Forum God Group: Classroom Teacher Posts: 11,231 Joined: 27-December 07 From: Sisters, OR Member No.: 75,503 Operating System: xp	seriouscode, Let's get a deeper scan of that computer. Please download DDS by sUBs from one of the following links and save it to your desktop. DDS.scr DDS.pif Disable any script blocking protection (How to Disable your Security Programs) Double click DDS icon to run the tool (may take up to 3 minutes to run) When done, DDS.txt will open. After a few moments, attach.txt will open in a second window. Save both reports to your desktop. --------------------------------------------------- Post the contents of the DDS.txt report in your next reply *Attach* the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and the click UPLOAD.

seriouscode View Member Profile	Jun 23 2009, 07:27 PM Post #23
Authentic Member Group: Authentic Member Posts: 75 Joined: 16-June 09 Member No.: 86,305 Operating System: Windows Vista	Tomk you are like a computer tech gawd to me and all other lesser computer beings lol!!! Before we continue, even if you can help me with all of my problems I just wanted to say thank you for being patient and also very very quick with your replies of help. Here is the DDS logs... both of them: DDS (Ver_09-05-14.01) - NTFSx86 Run by Casabetoa at 21:21:55.15 on Tue 06/23/2009 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_13 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.139 [GMT -4:00] AV: Norton Internet Security On-access scanning disabled (Updated) {E10A9785-9598-4754-B552-92431C1C35F8} FW: Norton Internet Security enabled {7C21A4C9-F61F-4AC4-B722-A6E19C16F220} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch C:\WINDOWS\system32\svchost -k rpcss C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k NetworkService C:\WINDOWS\system32\svchost.exe -k LocalService C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\svchost.exe -k LocalService C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\wbem\unsecapp.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\SanDisk\Sansa Updater\SansaDispatch.exe C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Casabetoa\Desktop\dds.pif C:\WINDOWS\system32\wbem\wmiprvse.exe ============== Pseudo HJT Report =============== uSearch Page = hxxp://search.live.com uDefault_Page_URL = hxxp://www.msn.com mSearchAssistant = hxxp://search.live.com/sphome.aspx mWinlogon: Userinit=c:\windows\system32\userinit.exe BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: NCO 2.0 IE BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\common files\symantec shared\coshared\browser\2.0\coIEPlg.dll BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\progra~1\common~1\symant~1\ids\IPSBHO.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: Show Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\common files\symantec shared\coshared\browser\2.0\CoIEPlg.dll TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe" mRun: [osCheck] "c:\program files\norton internet security\osCheck.exe" mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide mRun: [MSConfig] c:\windows\pchealth\helpctr\binaries\MSConfig.exe /auto mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t uPolicies-explorer: MaxRecentDocs = 99 (0x63) mPolicies-system: HideShutdownScripts = 0 (0x0) IE: &Search IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab DPF: {362C56AA-6E4F-40C7-A0B5-85501DBDAD77} - hxxp://i.dell.com/images/global/js/scanner/SysProExe.cab DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1006.cab DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab DPF: {CAFEEFAC-0015-0000-0012-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_12-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\casabe~1\applic~1\mozilla\firefox\profiles\jy7v2by6.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com/ FF - prefs.js: network.proxy.type - 2 FF - plugin: c:\program files\virtual earth 3d\npVE3D.dll ---- FIREFOX POLICIES ---- FF - user.js: yahoo.homepage.dontask - true ============= SERVICES / DRIVERS =============== R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-5-26 64160] R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-5-12 130936] R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-5-26 9968] R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-5-26 72944] R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\CCSVCHST.EXE [2007-8-25 149352] R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\CCSVCHST.EXE [2007-8-25 149352] R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-3-9 1003344] R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\common files\symantec shared\CCSVCHST.EXE [2007-8-25 149352] R2 TomTomHOMEService;TomTomHOMEService;c:\program files\tomtom home 2\TomTomHOMEService.exe [2009-4-8 92008] R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2009-2-26 101936] R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20090623.002\NAVENG.SYS [2009-6-23 89104] R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20090623.002\NAVEX15.SYS [2009-6-23 876144] R3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-5-26 7408] R3 Symantec Core LC;Symantec Core LC;c:\progra~1\common~1\symant~1\ccpd-lc\symlcsvc.exe [2008-7-8 1251720] S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [2007-5-29 23888] S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2009-5-12 348752] S3 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2009-5-12 1095560] =============== Created Last 30 ================ 2009-06-23 21:16 <DIR> --d-h--- c:\windows\PIF 2009-06-23 11:33 15,427 a------- c:\windows\system32\79995z9al2690.exe 2009-06-22 23:58 <DIR> --d----- c:\docume~1\casabe~1\applic~1\Malwarebytes 2009-06-22 23:57 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys 2009-06-22 23:56 19,096 a------- c:\windows\system32\drivers\mbam.sys 2009-06-22 23:56 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware 2009-06-22 23:56 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes 2009-06-22 23:56 <DIR> --d----- c:\program files\Trend Micro 2009-06-22 12:32 3,982 a------- c:\windows\195athief14z2.ocx 2009-06-22 09:47 246,272 -c------ c:\windows\system32\dllcache\ieproxy.dll 2009-06-22 09:47 12,800 -c------ c:\windows\system32\dllcache\xpshims.dll 2009-06-21 09:08 6,401 a------- c:\windows\system32\e655hzeat54759.exe 2009-06-20 16:56 16,448 a------- c:\windows\system32\1z539spambo5171.dll 2009-06-19 14:55 16,152 a------- c:\windows\system32\50219tzoj6f59.dll 2009-06-19 10:30 2,699 a------- c:\windows\system32\9950s5ywarz401.dll 2009-06-18 15:21 <DIR> --d----- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com 2009-06-18 15:20 <DIR> --d----- c:\program files\SUPERAntiSpyware 2009-06-18 15:20 <DIR> --d----- c:\docume~1\casabe~1\applic~1\SUPERAntiSpyware.com 2009-06-18 15:19 <DIR> --d----- c:\program files\common files\Wise Installation Wizard 2009-06-17 12:36 6,118 a------- c:\windows\5509downl9ader2z25.exe 2009-06-15 23:00 6,939 a------- c:\windows\2004no9-azv5rus4c8.dll 2009-06-15 22:14 9,317 a------- c:\windows\563zd9wnload5r1803.cpl 2009-06-15 21:59 <DIR> --dsh--- c:\documents and settings\casabetoa\IECompatCache 2009-06-15 15:32 9,992 a------- c:\windows\9949not-az5irus29d.exe 2009-06-15 02:28 2,976 a------- c:\windows\627dzpa9se1255.bin 2009-06-11 16:03 12,139 a------- c:\windows\system32\7f77sp9rsz2959.exe 2009-06-10 18:37 9,597 a------- c:\windows\system32\13595vi9us661z.ocx 2009-06-10 02:18 3,532 a------- c:\windows\13573virusz9.cpl 2009-06-08 20:03 14,460 a------- c:\windows\7545addwarz1981.ocx 2009-06-08 18:26 7,169 a------- c:\windows\system32\23327n9t-a-v5rus18z.dll 2009-06-08 12:10 3,283 a------- c:\windows\system32\z2250sp579d.bin 2009-06-08 05:20 13,660 a------- c:\windows\424a5pyzar91336.exe 2009-06-06 22:17 <DIR> --d----- c:\program files\TomTom International B.V 2009-06-06 15:10 17,222 a------- c:\windows\system32\60459zw5loader2458.cpl 2009-06-06 09:34 17,799 a------- c:\windows\system32\592no9-a-5iruza.dll 2009-05-28 02:01 6,597 a------- c:\windows\4965vz92950.dll 2009-05-28 01:20 12,786 a------- c:\windows\30997ha9kzool7945.cpl 2009-05-27 15:06 3,503 a------- c:\windows\system32\57e95hreat2301z.cpl 2009-05-26 22:18 15,688 a------- c:\windows\system32\lsdelete.exe 2009-05-26 15:41 3,899 a------- c:\windows\system32\1e01sp9rze27895.bin 2009-05-26 08:46 17,706 a------- c:\windows\system32\247569rojz5.cpl 2009-05-26 08:04 64,160 a------- c:\windows\system32\drivers\Lbd.sys 2009-05-26 08:02 <DIR> -cd-h--- c:\docume~1\alluse~1\applic~1\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F} 2009-05-26 08:01 <DIR> --d----- c:\program files\Lavasoft 2009-05-25 09:48 11,590 a------- c:\windows\29229spyz559.exe 2009-05-25 08:16 16,311 a------- c:\windows\system32\5259spamb9t505z.bin ==================== Find3M ==================== 2009-06-22 08:26 130,936 a------- c:\windows\system32\drivers\PCTCore.sys 2009-05-21 16:34 13,635 a------- c:\windows\2c49b5ckdoorz5369.exe 2009-05-21 15:45 3,997 a------- c:\windows\system32\29zddownlo5der2161.bin 2009-05-19 03:55 6,368 a------- c:\windows\system32\6272no9-a5virusz21.dll 2009-05-13 01:15 915,456 a------- c:\windows\system32\wininet.dll 2009-05-12 12:19 12,191 a------- c:\windows\5590doznl95der2009.exe 2009-05-11 23:44 10,019 a------- c:\windows\z8065acktool219.exe 2009-05-11 01:05 3,233 a------- c:\windows\system32\7115a9dwzre69.dll 2009-05-08 22:23 410,984 a------- c:\windows\system32\deploytk.dll 2009-05-08 14:55 15,256 a------- c:\windows\system32\29558hacktooz341.exe 2009-05-07 16:08 12,690 a------- c:\windows\system32\28425tzoj55a9.exe 2009-05-07 11:32 345,600 a------- c:\windows\system32\localspl.dll 2009-05-07 10:00 14,230 a------- c:\windows\3566zhre5t7039.exe 2009-05-06 06:06 13,910 a------- c:\windows\system32\65e8add9are152z.bin 2009-05-06 03:41 3,050 a------- c:\windows\system32\9bzcback5oor3188.exe 2009-05-03 12:42 12,249 a------- c:\windows\system32\19e8sza5se2342.exe 2009-04-27 02:01 13,584 a------- c:\windows\system32\3390sza9bot5f5.dll 2009-04-25 23:28 5,201 a------- c:\windows\system32\z1793worm1d05.dll 2009-04-25 03:45 12,591 a------- c:\windows\system32\5359h9cktzol57a.bin 2009-04-22 17:14 16,346 a------- c:\windows\z2705s5y592.exe 2009-04-20 15:05 6,831 a------- c:\windows\12f45hie92190z.bin 2009-04-18 22:19 3,501 a------- c:\windows\7622s5ywaze9797.dll 2009-04-17 08:26 1,847,168 a------- c:\windows\system32\win32k.sys 2009-04-16 16:50 9,142 a------- c:\windows\system32\97491z5rus786.dll 2009-04-15 10:51 585,216 a------- c:\windows\system32\rpcrt4.dll 2009-04-13 06:16 16,649 a------- c:\windows\system32\30696t5oz67c.dll 2009-04-12 19:54 11,010 a------- c:\windows\system32\4ed7zownload9r357.exe 2009-04-12 19:51 4,228 a------- c:\windows\26z60v95us120.bin 2009-04-11 23:00 14,069 a------- c:\windows\system32\4fbed9wnl5zder962.bin 2009-04-11 13:42 12,101 a------- c:\windows\system32\25589spambotz15.bin 2009-04-11 02:58 11,442 a------- c:\windows\13818spa5bzt950.exe 2009-04-09 19:09 13,893 a------- c:\windows\5998sparse18z1.exe 2009-04-09 11:46 9,043 a------- c:\windows\5194z5wnloader1003.exe 2009-04-09 06:33 2,935 a------- c:\windows\z615s5y3959.dll 2009-04-06 14:10 3,230 a------- c:\windows\21e7z5ckdoo9784.exe 2009-04-04 14:21 18,194 a------- c:\windows\system32\1927thi5z1148.bin 2009-04-04 06:01 12,975 a------- c:\windows\system32\4cc9zhrea513979.dll 2009-04-02 01:53 6,995 a------- c:\windows\453bzir2598.bin 2009-03-28 14:44 4,295 a------- c:\windows\system32\5e23downloadez295.bin 2009-03-18 19:53 30,016 a------- c:\docume~1\casabe~1\applic~1\GDIPFONTCACHEV1.DAT 2008-08-23 18:59 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008082320080824\index.dat ============= FINISH: 21:22:42.67 =============== Attached File(s) Attach.txt ( 12.85K ) Number of downloads: 11

Tomk View Member Profile	Jun 23 2009, 08:20 PM Post #24
Forum God Group: Classroom Teacher Posts: 11,231 Joined: 27-December 07 From: Sisters, OR Member No.: 75,503 Operating System: xp	seriouscode, Thanks for the compliment but I'm not much of a Tech. I'm just a trained malware fighter. There are some "odd" entries in there. Let's do a few things: You've got some old Java files in there that are a security risk. We need to get rid of the old ones and only keep the new. Using Add or Remove programs in your Control Panel, Please uninstall: J2SE Runtime Environment 5.0 Update 12 Java™ 6 Update 7 Then for good measure: JavaRa ...by: Paul McLain and Fred de Vries Please download JavaRa (Copyright © 2008 RaProducts.org) and unzip it to your desktop. *Please close any instances of Internet Explorer before continuing!* Print these instructions...you won't have Internet access during this particular phase! Double-click on JavaRa.exe to start the program. From the drop-down menu, choose English or the appropriate language...and click on Select. JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer. Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK. A logfile will pop up. Please save it to a convenient location. Copy and paste the contents of the JavaRa log, in your next reply. Now let's see a bit more about those Odd entries. Download ComboFix from one of these locations: Link 1 Link 2 Link 3 * IMPORTANT !!! Save ComboFix.exe to your Desktop Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link --> http://forums.whatthetech.com/How_Disable_...ams_t96260.html Double click on ComboFix.exe & follow the prompts. As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware. Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console. Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures. Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message: Click on Yes, to continue scanning for malware. When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply. Notes: 1. Do not mouse-click Combofix's window while it is running. That may cause it to stall. 2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions. 3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser. 4. Combofix prevents autorun of ALL** CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper. 5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Tomk View Member Profile	Jun 23 2009, 08:22 PM Post #25
Forum God Group: Classroom Teacher Posts: 11,231 Joined: 27-December 07 From: Sisters, OR Member No.: 75,503 Operating System: xp	Also, let's close out your original computer. Log looks good Now to remove most of the tools that we have used in fixing your machine: Make sure you have an Internet Connection. Download OTC to your desktop and run it A list of tool components used in the cleanup of malware will be downloaded. If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so. Click Yes to begin the cleanup process and remove these components, including this application. You will be asked to reboot the machine to finish the cleanup process. If you are asked to reboot the machine choose Yes. You need to create a new Clean restore point: Download SysRestorePoint to your desktop and unzip it to it's own folder. Double click SysRestorePoint.exe so that we can make a new system restore point. A box will pop up after it has made a new point, usually after a few seconds. Close that window and exit the program. Remove all previous Restore Points Click Start Menu > Run > copy and paste cleanmgr You may be asked to choose drive. Choose C: At top, click on More Options tab. Click Clean up... button in the System Restore box. Click on Yes button. When finished, click on Cancel button to exit. Double-click My Computer. Click the Tools menu, and then click Folder Options. Click the View tab. Check "Hide file extensions for known file types." Under the "Hidden files" folder, Uncheck "Show hidden files and folders." Check "Hide protected operating system files." Click Apply, and then click OK.

Tomk View Member Profile	Jun 24 2009, 02:14 PM Post #27
Forum God Group: Classroom Teacher Posts: 11,231 Joined: 27-December 07 From: Sisters, OR Member No.: 75,503 Operating System: xp	seriouscode, Mbam is a good program to keep. Run it once a month or so to supplement your other security. It has no real-time component so it won't conflict with your other programs. Just be sure to update it before running a scan because definitions are updated often. COMBOFIX-Script Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below: CODE File:: c:\windows\system32\3b6athi5f1809z.exe c:\windows\system32\3527vi5z609.dll c:\windows\system32\5079hackt95z181.exe c:\windows\system32\75c3th5eat9071z.dll c:\windows\system32\492fzpyware1658.dll c:\windows\system32\9edsteal54z7.bin c:\windows\system32\5a6f5azkdo9r2659.exe c:\windows\system32\8851spzmb5t76a9.dll c:\windows\system32\54960s9zmbotd2.dll c:\windows\system32\3682sze9l3512.bin c:\windows\system32\39586zro51cd.bin c:\windows\system32\52193viruz50b.dll c:\windows\system32\35d6threa9z1675.bin c:\windows\system32\58f0spa5se1695z.exe c:\windows\system32\77055pyw9rez872.bin c:\windows\system32\deabackdzor25529.exe c:\windows\system32\7348th9e517z8.exe c:\windows\system32\5b19threat181z1.exe c:\windows\system32\55d9zp9ware811.dll c:\windows\system32\5659h9cktooz59.exe c:\windows\system32\5e9z5parse2926.dll c:\windows\system32\59z7not-a-virus48f.exe c:\windows\system32\e44s9yz5re1800.dll c:\windows\system32\988btzrea529969.bin c:\windows\system32\5d59downloaderz124.dll c:\windows\system32\3bz2threat62509.dll c:\windows\system32\52743s9y6ebz.dll c:\windows\system32\eb39pywzre2359.bin c:\windows\system32\31895hreat91z5.exe c:\windows\system32\6a7cspa5s92893z.bin c:\windows\system32\77z2virus995.exe c:\windows\system32\5510dzwnload9r2378.exe c:\windows\system32\7ezbthi5f2958.exe c:\windows\system32\7256thie92574z.dll c:\windows\system32\983z9roj775.exe c:\windows\system32\z993vi5us905.exe c:\windows\system32\6509threat2905z.dll c:\windows\system32\693dthreat19z975.dll c:\windows\system32\5987thief26z5.dll c:\windows\system32\3958threa91890z5.bin c:\windows\system32\3czcba9kdoor5611.dll c:\windows\system32\z597sp56b9.exe c:\windows\system32\4067vzr31965.dll c:\windows\system32\598bthreat2852z.exe c:\windows\system32\79995z9al2690.exe c:\windows\system32\e655hzeat54759.exe c:\windows\system32\50219tzoj6f59.dll c:\windows\system32\9950s5ywarz401.dll c:\windows\system32\7f77sp9rsz2959.exe c:\windows\system32\z2250sp579d.bin c:\windows\system32\592no9-a-5iruza.dll c:\windows\system32\5259spamb9t505z.bin c:\windows\system32\6272no9-a5virusz21.dll c:\windows\system32\7115a9dwzre69.dll c:\windows\system32\32195zrm4dd.exe c:\windows\system32\52z2hacktool59f.exe c:\windows\system32\7d945hreaz27397.dll c:\windows\system32\z9b5ackdoor597.dll c:\windows\system32\65e8add9are152z.bin c:\windows\system32\9bzcback5oor3188.exe c:\windows\system32\3390sza9bot5f5.dll c:\windows\system32\z1793worm1d05.dll c:\windows\system32\5359h9cktzol57a.bin c:\windows\system32\win32k.sys c:\windows\system32\97491z5rus786.dll c:\windows\system32\rpcrt4.dll c:\windows\system32\4ed7zownload9r357.exe c:\windows\system32\4fbed9wnl5zder962.bin c:\windows\system32\4cc9zhrea513979.dll c:\windows\system32\5e23downloadez295.bin RegLockDel:: [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239}\TreatAs] [HKEY_LOCAL_MACHINE\software\Classes\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}\ProxyStubClsid] [HKEY_LOCAL_MACHINE\software\Classes\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}\ProxyStubClsid32] [HKEY_LOCAL_MACHINE\software\Classes\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}\TypeLib] [HKEY_LOCAL_MACHINE\software\Classes\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}\ProxyStubClsid] [HKEY_LOCAL_MACHINE\software\Classes\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}\ProxyStubClsid32] [HKEY_LOCAL_MACHINE\software\Classes\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}\TypeLib] [HKEY_LOCAL_MACHINE\software\Classes\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE}\ProxyStubClsid] [HKEY_LOCAL_MACHINE\software\Classes\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE}\ProxyStubClsid32] [HKEY_LOCAL_MACHINE\software\Classes\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE}\TypeLib] [HKEY_LOCAL_MACHINE\software\Classes\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}\1.0] Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop. Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results". Referring to the screenshot above, drag CFScript.txt into ComboFix.exe. ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal. When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply. CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

seriouscode View Member Profile	Jun 24 2009, 08:18 PM Post #28
Authentic Member Group: Authentic Member Posts: 75 Joined: 16-June 09 Member No.: 86,305 Operating System: Windows Vista	Tomk dude I have got a seriously critically fatal problem!!! after copying and pasting the script you have posted and then dragging it into the ComboFix the program started and progressed normally. Then out of no where a system failure caused a windows error shut down that closed my computer down closeing the ComboFix program prematurely, with a countdown box. Since then my computer has been rebooting but never going past the windows loading screen. I tried F8 safe mode with no network and it did its thing then when it got to the windows load screen it rebooted again. I let it go on for a little bit but all it does is keep rebooting, then it hits a blue screen with 2 lines of txt that i can not read and reboots. Man i'm scared here, whats going on? what can i do? Please help FYI i'm typing from the original computer we fixed together.

Tomk View Member Profile	Jun 24 2009, 09:10 PM Post #29
Forum God Group: Classroom Teacher Posts: 11,231 Joined: 27-December 07 From: Sisters, OR Member No.: 75,503 Operating System: xp	seriouscode, I notgood up. There are two entries that shouldn't have been in that script. c:\windows\system32\win32k.sys c:\windows\system32\rpcrt4.dll The first thing I want you to try, is last known good configuration. I suspect it won't work but I'd like to try it. Then we we've got a couple of other things to do to fix this. So... I need you to start your computer and tap F8 like you're going to try to go into safe mode, but instead of choosing Safe Mode, choose Last Known Good Configuration. Then let me know how it goes.

seriouscode View Member Profile	Jun 24 2009, 09:25 PM Post #30
Authentic Member Group: Authentic Member Posts: 75 Joined: 16-June 09 Member No.: 86,305 Operating System: Windows Vista	still dead. Very dead. All safe mode paths lead to a dead end. What next?

« Next Oldest · Infections Removal · Next Newest »

6 Pages

< 1 2 3 4 > »

1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)

0 Members:

Topic Title	Replies	Topic Starter	Views	Last Action
Windows Made Easy - Vista Unable to login to Windows Vista.	1	appleoddity	125	Today, 07:04 AM Last post by: Plursuild
Infections Removal on/off then serious error!	5	andrew2009	96	Yesterday, 06:16 PM Last post by: andrew2009
Infections Removal [Resolved] Can only browse one site in IE6 12	20	Wakenaam	366	Yesterday, 09:54 AM Last post by: Tomk
Infections Removal [Resolved] Computer takeover 12	16	mesa215	286	Yesterday, 12:05 AM Last post by: Raktor